Privacy Policy

Last updated: 2026-07-01

This Privacy Policy explains how NEX SOCIETÀ COOPERATIVA – IMPRESA SOCIALE ("Nex", "we") processes personal data in connection with your use of NexCRM ("the Service"), in accordance with Regulation (EU) 2016/679 (the "GDPR").

1. Data Controller

The data controller for account and platform-usage data is:
NEX SOCIETÀ COOPERATIVA – IMPRESA SOCIALE
Privacy contact: info@nexcoop.it

2. Two distinct roles: Controller and Processor

NexCRM is a multi-tenant CRM. Depending on the data in question, Nex acts in one of two roles:

• Data Controller for your account data (name, email, password, organization membership, login logs, preferences) needed to provide the Service to you as a user.
• Data Processor for data your organization enters into the CRM about third parties (e.g. contacts, companies, notes, documents, meeting recordings and transcripts). In this case, your organization is the Controller, determining the purposes and means of processing; Nex only processes this data on the organization's documented instructions, as set out in the Terms of Use.

3. Categories of data processed

• Account data: name, email, hashed password, preferred language, organization, role/permissions.
• CRM data entered by the organization: company and contact person records, notes, tasks.
• Documents: uploaded files (PDF, images, etc.), automatically classified using AI.
• Meetings: audio recordings you choose to upload, along with AI-generated transcripts and summaries.
• Technical data: IP address, application logs, session/authentication cookies.
• Optional integrations: if you connect Google Calendar, we access only the calendar data required for syncing; you can disconnect at any time from settings.

4. Purposes and legal basis

• Providing the Service and managing your account — performance of a contract (Art. 6(1)(b) GDPR).
• Automated document classification and meeting summarization via AI — performance of a contract and legitimate interest in delivering functionality requested by the organization (Art. 6(1)(b) and (f)).
• Security, abuse prevention, application logging — legitimate interest (Art. 6(1)(f)).
• Optional Google Calendar integration — consent (Art. 6(1)(a)), which you may withdraw at any time.
• Legal and accounting obligations — legal obligation (Art. 6(1)(c)).

5. Automated processing and artificial intelligence

The Service uses AI models (Amazon Bedrock) to automatically classify uploaded documents and extract key information, and speech-to-text services (Amazon Transcribe) to convert meeting recordings into text, which is then summarized using AI. These features are designed to assist users and do not produce decisions with significant legal effects without human involvement: outputs always remain subject to your review before being treated as final.

6. Recipients and sub-processors

Data is processed with the help of the following providers, acting as sub-processors:

• Amazon Web Services (AWS) — infrastructure hosting, file storage (Amazon S3), document classification and summarization (Amazon Bedrock), audio transcription (Amazon Transcribe).

Where these providers process data outside the European Economic Area, transfers are carried out under appropriate GDPR safeguards (such as Standard Contractual Clauses).

7. Data retention

Account data is retained for the duration of the contractual relationship and deleted or anonymized within a reasonable period after termination, subject to legal retention obligations. CRM data entered by an organization is retained according to that organization's instructions and retention policies. Files in the temporary upload area are automatically removed if they do not complete the archiving process.

8. Your rights

Under Articles 15-22 GDPR you have the right to access your data, request rectification or erasure, restrict processing, request data portability, object to processing, and withdraw consent where applicable. If your personal data was entered into the CRM by an organization you are not a member of, please contact that organization directly, or write to info@nexcoop.it and we will help direct your request. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.gpdp.it) or your local supervisory authority.

9. Cookies

We use only strictly necessary technical cookies for authentication and session management. We do not use third-party profiling or marketing cookies.

10. Security

We implement appropriate technical and organizational measures, including encryption in transit (HTTPS), role- and permission-based access control, change history/audit trails, and soft deletion of records.

11. Children

The Service is intended for professional/business use and is not directed at minors.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of any material changes.

13. Contact

For any privacy-related request: info@nexcoop.it